技能 contribute-catalog

📦

contribute-catalog

Name: contribute-catalog
Author: heygen-com

内容修订 r1 中风险 ⚙️ 外部命令🌐 网络访问

贡献 HyperFrames 目录项

创建可复用的 HyperFrames 目录项需要结构、元数据、预览和审核步骤。此技能会指导贡献者从想法推进到已验证的拉取请求。

支持: Claude Codex Code(CC)

⚠️ 50 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "contribute-catalog" from https://skillstore.io/skills/heygen-com-contribute-catalog.md and its manifest at https://skillstore.io/api/skills/heygen-com-contribute-catalog/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/heygen-com-contribute-catalog.md 已签名 manifest GET /api/skills/heygen-com-contribute-catalog/manifest 已签名 lockfile GET /api/skills/heygen-com-contribute-catalog/lockfile

测试它

正在使用“contribute-catalog”。我想为社交视频添加一种醒目的卡拉 OK 字幕样式。

预期结果:

此技能会将其识别为区块，提出 registry 位置，列出字幕可读性规则，并准备验证和预览任务。

正在使用“contribute-catalog”。我构建了一个闪光叠加效果，想把它放进公共目录。

预期结果:

此技能会将其归类为组件，检查命名和元数据需求，并说明如何打包以供审核。

正在使用“contribute-catalog”。在我打开拉取请求之前，检查我遗漏了什么。

预期结果:

此技能会生成提交检查清单，涵盖 linting、验证、格式化、registry 更新、生成的文档、预览资产和拉取请求详情。

安全审计

中风险

v4 • 2026/7/5 打开版本化报告

Most static Ruby backtick detections are Markdown, JSON, or JavaScript template false positives rather than shell execution. Real risks remain around documented CLI execution, publishing, GitHub actions, AWS upload guidance, and third-party CDN resources. No evidence found for prompt injection or covert data-exfiltration intent.

已扫描文件

630

分析行数

复核项

已忽略误报

已确认安全问题 (2)

中

SKILL.md:164

Cloud Credential Upload Workflow

SKILL.md directs internal contributors to run scripts/upload-docs-images.sh with the AWS profile engineering-767398024897. This could upload assets using cloud credentials if an agent runs it without explicit approval.

The instruction explicitly names an upload script and AWS profile. The context says it is for internal contributors, so the risk is controlled but real.

中

SKILL.md:186-197

External Publication Workflow

SKILL.md includes a shipping flow that publishes to hyperframes.dev, pushes a branch, and creates a GitHub pull request. These commands change external state and should not run without user confirmation.

The listed steps explicitly publish, push, and create a pull request. The behavior matches the contribution purpose, but it has external side effects.

能力复核项 (14)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中

SKILL.md:144-147

Ruby/shell backtick execution

```bash

The fenced bash section tells the agent to run local HyperFrames lint and validate commands. The commands are expected for this workflow but still execute tools in the user workspace.

中

SKILL.md:151-160

Ruby/shell backtick execution

```bash

This preview section directs rendering snapshots and running npx hyperframes publish. It can execute local tooling and publish externally, so it requires user approval.

中

SKILL.md:164

Ruby/shell backtick execution

- **HeyGen internal contributors:** run `scripts/upload-docs-images.sh` (requires AWS profile `engin

The line instructs internal contributors to run an upload script using a named AWS profile. That is a real command with cloud-side effects if executed.

中

SKILL.md:173-198

Ruby/shell backtick execution

```bash

The shipping block includes git, npx, publish, push, and gh pr create commands. These can modify files and remote state, so they are real external command risks.

中

SKILL.md:200-204

Ruby/shell backtick execution

**If you don't have a GitHub account:** you need one to open a PR. Sign up at https://github.com/sig

The paragraph tells users to run gh auth login for GitHub access. This is expected for pull requests but invokes an external authentication command.

中

SKILL.md:204-205

Ruby/shell backtick execution

- [ ] `hyperframes lint` → 0 errors

The quality gate requires running hyperframes lint and validate commands. These are bounded project checks but still execute external CLI tooling.

中

SKILL.md:205-206

Ruby/shell backtick execution

- [ ] `hyperframes validate` → 0 console errors

The quality gate includes hyperframes validate and adjacent npx checks. The usage is legitimate validation, but it is still command execution in the repository.

中

SKILL.md:206-207

Ruby/shell backtick execution

- [ ] `npx oxfmt --check` passes

The checklist requires npx oxfmt --check. npx execution is expected here but can invoke local or package-managed tooling.

中

SKILL.md:208-209

Ruby/shell backtick execution

- [ ] `scripts/generate-catalog-pages.ts` run (docs page generated)

The checklist requires running the catalog generation script and the publish command. These can modify generated docs and publish a project URL.

低

templates.md:13

Hardcoded URL

href="https://fonts.googleapis.com/css2?family=Montserrat:wght@800;900&display=swap"

The template loads Google Fonts from an external URL. This is visible and common, but generated pages will contact a third-party service.

低

templates.md:16

Hardcoded URL

The caption template loads GSAP from jsDelivr. The version is pinned, but it still executes third-party browser code without an integrity attribute.

低

templates.md:191

Hardcoded URL

The VFX template loads GSAP from jsDelivr. The version is pinned, but it still executes third-party browser code without an integrity attribute.

低

templates.md:192

Hardcoded URL

The VFX template loads Three.js from jsDelivr. The version is pinned, but it still executes third-party browser code without an integrity attribute.

低

templates.md:377

Hardcoded URL

The component template loads GSAP from jsDelivr. The version is pinned, but it still executes third-party browser code without an integrity attribute.

风险因素

⚙️ 外部命令 (49)

🌐 网络访问 (10)

SKILL.md:63 SKILL.md:85 SKILL.md:200 templates.md:13 templates.md:16 templates.md:191 templates.md:192 templates.md:322 templates.md:344 templates.md:377

审计者: codex 查看审计历史 →

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/heygen-com-contribute-catalog/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/heygen-com-contribute-catalog/security.svg)](https://skillstore.io/skills/heygen-com-contribute-catalog?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/heygen-com-contribute-catalog?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/heygen-com-contribute-catalog/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/heygen-com-contribute-catalog.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

heygen-com. (2026). contribute-catalog security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/heygen-com-contribute-catalog/audits/4

BibTeX 引用

@techreport{heygen-com-heygen-com-contribute-catalog-2026,
  author = {heygen-com},
  title = {contribute-catalog security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/heygen-com-contribute-catalog/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "contribute-catalog security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "heygen-com"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/heygen-com-contribute-catalog/audits/4"
identifiers:
  - type: other
    value: "skillstore:heygen-com-contribute-catalog:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 高

架构

可维护性

内容

社区

规范符合性

你能构建什么

提交字幕样式

构建新的字幕区块，包含可读文本、定时词语高亮、元数据、预览和验证步骤。

创建 VFX 区块

准备基于 Three.js 的视觉特效，包含确定性动画和可用于目录的预览资产。

审核 Registry 新增项

检查拟议目录项是否符合命名、元数据、验证和发布要求。

试试这些提示

开始一个目录想法

帮我贡献一个 HyperFrames 目录项。在选择区块或组件之前，先询问你需要了解的信息。

搭建新区块

为名为 [name] 的新 HyperFrames 区块创建文件夹计划、元数据检查清单和实现步骤。

改编模板

为一个 [caption, VFX, or component] 项目使用合适的 HyperFrames 贡献模板，并说明我必须替换哪些内容。

准备拉取请求

审核我的目录贡献计划，并列出我必须完成的验证、预览、发布和拉取请求步骤。

最佳实践

在创建文件或元数据之前确认项目类型。
在请求维护者审核之前运行验证和预览步骤。
在运行会发布、推送、认证或上传资产的命令之前先询问。

避免

将贡献工作流用于项目内的私有编辑。
提交没有预览媒体或生成的目录文档的项目。
未获得用户明确批准就运行发布、GitHub 或云上传命令。

常见问题

此技能用于使用现有目录项吗？

不是。它用于贡献新的公共目录区块或组件。

区块和组件有什么区别？

区块是具有尺寸和时长的完整组合。组件是在另一个组合中复用的片段。

它会自动生成预览资产吗？

它会说明预览工作流。用户仍然需要本地工具，并且发布或上传需要批准。

它能帮助处理字幕吗？

可以。它包含字幕规则，涵盖可读性、时间、卡拉 OK 高亮和溢出处理。

它能帮助处理 Three.js 特效吗？

可以。它提供 VFX 指导，用于确定性渲染和由时间线控制的动画。

它会替我打开拉取请求吗？

它会列出拉取请求步骤。推送或创建拉取请求的命令应需要明确确认。

开发者详情

作者

heygen-com

许可证

MIT

Skillstore 修订

版本提示

作者未声明版本。

仓库

https://github.com/heygen-com/hyperframes/tree/main/skills/contribute-catalog/

引用

30c73eac2afe762f6aa9c4553158769369d47351

维护新鲜度

2026/7/22

使用量

1 次下载 · 0 次浏览

文件结构

📄 SKILL.md

📄 templates.md